@nowcrew/daemon 0.6.87-beta.3 → 0.6.87

package/dist/external-output.js

@@ -1,15 +1,104 @@
 export const EXTERNAL_ANSWER_OPEN = "<nowwork_external_answer>";
 export const EXTERNAL_ANSWER_CLOSE = "</nowwork_external_answer>";
-function retainedMarkerPrefix(value, marker) {
-    const maximum = Math.min(value.length, marker.length - 1);
-    for (let length = maximum; length > 0; length -= 1) {
-        if (marker.startsWith(value.slice(-length)))
-            return length;
+const MAX_MARKER_TAG_LENGTH = 96;
+const KNOWN_EXTERNAL_ANSWER_TAG = /^now+orkexternalanswer$/u;
+const CANONICAL_EXTERNAL_ANSWER_TAG = "noworkexternalanswer";
+function editDistanceWithin(value, target, maximum) {
+    if (Math.abs(value.length - target.length) > maximum)
+        return false;
+    let previous = Array.from({ length: target.length + 1 }, (_, index) => index);
+    for (let row = 1; row <= value.length; row += 1) {
+        const current = [row];
+        let rowMinimum = row;
+        for (let column = 1; column <= target.length; column += 1) {
+            const cost = value[row - 1] === target[column - 1] ? 0 : 1;
+            const distance = Math.min(previous[column] + 1, current[column - 1] + 1, previous[column - 1] + cost);
+            current.push(distance);
+            rowMinimum = Math.min(rowMinimum, distance);
+        }
+        if (rowMinimum > maximum)
+            return false;
+        previous = current;
+    }
+    return previous[target.length] <= maximum;
+}
+function resemblesExternalAnswerTag(name) {
+    if (name.includes("externalanswer"))
+        return true;
+    const canonicalized = name.replace(/^now+ork/u, "nowork");
+    return editDistanceWithin(canonicalized, CANONICAL_EXTERNAL_ANSWER_TAG, 2);
+}
+function classifyMarkerTag(body) {
+    const trimmed = body.trim();
+    const closing = trimmed.startsWith("/");
+    const name = (closing ? trimmed.slice(1) : trimmed)
+        .trim()
+        .toLowerCase()
+        .replace(/[_\-\s]/gu, "");
+    if (KNOWN_EXTERNAL_ANSWER_TAG.test(name))
+        return { closing, kind: "known" };
+    return {
+        closing,
+        kind: resemblesExternalAnswerTag(name) ? "suspicious" : "other",
+    };
+}
+function nextMarkerTag(value, from) {
+    let cursor = from;
+    while (cursor < value.length) {
+        const start = value.indexOf("<", cursor);
+        if (start < 0)
+            return null;
+        const end = value.indexOf(">", start + 1);
+        if (end < 0)
+            return null;
+        const body = value.slice(start + 1, end);
+        const classified = classifyMarkerTag(body);
+        if (classified.kind === "suspicious"
+            || (classified.kind === "known" && body.length > MAX_MARKER_TAG_LENGTH)) {
+            return { start, end: end + 1, closing: classified.closing, kind: "suspicious" };
+        }
+        if (classified.kind === "known") {
+            return { start, end: end + 1, closing: classified.closing, kind: "known" };
+        }
+        cursor = end + 1;
+    }
+    return null;
+}
+function parseExternalAnswerText(value) {
+    const sections = [];
+    let cursor = 0;
+    let contentStart = 0;
+    let inside = false;
+    let found = false;
+    for (;;) {
+        const tag = nextMarkerTag(value, cursor);
+        if (!tag)
+            break;
+        if (tag.kind === "suspicious")
+            return { kind: "rejected", text: "" };
+        if (tag.closing) {
+            if (!inside)
+                return { kind: "rejected", text: "" };
+            sections.push(value.slice(contentStart, tag.start));
+            inside = false;
+        }
+        else {
+            if (inside)
+                return { kind: "rejected", text: "" };
+            found = true;
+            inside = true;
+            contentStart = tag.end;
+        }
+        cursor = tag.end;
     }
-    return 0;
+    if (inside)
+        sections.push(value.slice(contentStart));
+    if (!found)
+        return { kind: "plain", text: value.trim() };
+    return { kind: "marked", text: sections.join("").trim() };
 }
 /**
- * 跨 chunk 的契约标签流式解码器:push() 逐段返回标签内文本(供 answerStream 实时转发);
+ * 跨 chunk 的契约标签解码器:push() 在合法闭合后返回完整标签块(供 answerStream 转发);
  * 同时记住整轮里**最后一个完整闭合**的标签块(`lastClosedBlock`),供完结时作为契约答案——
  * 只有闭合了的块才算数:半截块(被工具调用拆开的前半段)与叙述里提到的开标签
  * ("我会把结论包在 <marker> 里,先去跑测试")都不会被当成答案(review of a027bf15, C1)。
@@ -40,34 +129,63 @@ export class ExternalAnswerDecoder {
     }
     consume(value, output) {
         this.pending = "";
-        const marker = this.state === "outside" ? EXTERNAL_ANSWER_OPEN : EXTERNAL_ANSWER_CLOSE;
-        const markerAt = value.indexOf(marker);
-        if (markerAt >= 0) {
-            if (this.state === "inside") {
-                const head = value.slice(0, markerAt);
-                if (head)
-                    output.push(head);
-                const completed = `${this.block}${head}`.trim();
-                if (completed)
-                    this.closed = completed;
-                this.block = "";
-                this.state = "outside";
+        const appendInside = (text) => {
+            if (!text)
+                return;
+            this.block += text;
+        };
+        for (const character of value) {
+            if (this.pending) {
+                this.pending += character;
+                if (character === ">") {
+                    const body = this.pending.slice(1, -1);
+                    const tag = classifyMarkerTag(body);
+                    if (tag.kind === "known" && body.length <= MAX_MARKER_TAG_LENGTH) {
+                        if (tag.closing && this.state === "inside") {
+                            const completed = this.block.trim();
+                            if (completed) {
+                                this.closed = completed;
+                                output.push(completed);
+                            }
+                            this.block = "";
+                            this.state = "outside";
+                        }
+                        else if (!tag.closing && this.state === "outside") {
+                            this.block = "";
+                            this.state = "inside";
+                        }
+                        else {
+                            this.block = "";
+                            this.state = tag.closing ? "outside" : "inside";
+                        }
+                    }
+                    else if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.block = "";
+                        this.state = "outside";
+                    }
+                    else if (this.state === "inside") {
+                        appendInside(this.pending);
+                    }
+                    this.pending = "";
+                }
+                else if (this.pending.length > MAX_MARKER_TAG_LENGTH + 2) {
+                    const tag = classifyMarkerTag(this.pending.slice(1));
+                    if (tag.kind === "suspicious" || tag.kind === "known") {
+                        this.block = "";
+                        this.state = "outside";
+                    }
+                    else if (this.state === "inside") {
+                        appendInside(this.pending);
+                    }
+                    this.pending = "";
+                }
             }
-            else {
-                this.block = "";
-                this.state = "inside";
+            else if (character === "<") {
+                this.pending = character;
+            }
+            else if (this.state === "inside") {
+                appendInside(character);
             }
-            const remaining = value.slice(markerAt + marker.length);
-            if (remaining)
-                this.consume(remaining, output);
-            return;
-        }
-        const retained = retainedMarkerPrefix(value, marker);
-        const safe = retained > 0 ? value.slice(0, -retained) : value;
-        this.pending = retained > 0 ? value.slice(-retained) : "";
-        if (this.state === "inside" && safe) {
-            output.push(safe);
-            this.block += safe;
         }
     }
 }
@@ -104,20 +222,7 @@ export function decodeExternalOutputEvent(runtime, event, decoder) {
         : [];
 }
 export function stripExternalAnswerMarkers(value) {
-    const sections = [];
-    let cursor = 0;
-    while (cursor < value.length) {
-        const openAt = value.indexOf(EXTERNAL_ANSWER_OPEN, cursor);
-        if (openAt < 0)
-            break;
-        const contentAt = openAt + EXTERNAL_ANSWER_OPEN.length;
-        const closeAt = value.indexOf(EXTERNAL_ANSWER_CLOSE, contentAt);
-        if (closeAt < 0)
-            return value.slice(contentAt).trim();
-        sections.push(value.slice(contentAt, closeAt));
-        cursor = closeAt + EXTERNAL_ANSWER_CLOSE.length;
-    }
-    return (sections.length > 0 ? sections.join("") : value).trim();
+    return parseExternalAnswerText(value).text;
 }
 /**
  * 提取 marker 内容:有 marker 返回拼接内容(trim,空→null),无 marker 返回 null。
@@ -125,25 +230,6 @@ export function stripExternalAnswerMarkers(value) {
  * 本函数用于判定"agent 是否给出了频道直接回复"——必须能区分有无 marker。
  */
 export function extractExternalAnswer(value) {
-    const parts = [];
-    let found = false;
-    let rest = value;
-    for (;;) {
-        const open = rest.indexOf(EXTERNAL_ANSWER_OPEN);
-        if (open < 0)
-            break;
-        found = true;
-        const afterOpen = rest.slice(open + EXTERNAL_ANSWER_OPEN.length);
-        const close = afterOpen.indexOf(EXTERNAL_ANSWER_CLOSE);
-        if (close < 0) {
-            parts.push(afterOpen);
-            break;
-        }
-        parts.push(afterOpen.slice(0, close));
-        rest = afterOpen.slice(close + EXTERNAL_ANSWER_CLOSE.length);
-    }
-    if (!found)
-        return null;
-    const answer = parts.join("").trim();
-    return answer.length > 0 ? answer : null;
+    const parsed = parseExternalAnswerText(value);
+    return parsed.kind === "marked" && parsed.text ? parsed.text : null;
 }

package/dist/main.js

@@ -24,7 +24,7 @@ import { formatDaemonStartupError } from "./daemon-startup-error.js";
 import { assertManagedServiceStartup } from "./managed-service-startup.js";
 import { daemonGlobalInstallation } from "./daemon-installation.js";
 import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
-import { loadStorageRuntime } from "./storage-runtime.js";
+import { createStorageRuntimeOwnershipBinding, loadStorageRuntime } from "./storage-runtime.js";
 import { readStorageMigrationReceipt } from "./storage-migration-controller.js";
 import { storageMigrationStatusReplay } from "./storage-status-replay.js";
 import { runStorageWorkerCommand } from "./storage-worker-command.js";
@@ -160,6 +160,9 @@ async function main() {
                 ...(process.getuid === undefined ? {} : { uid: process.getuid() }),
                 environment: process.env,
             });
+        const targetStorageBinding = storageRuntime === null
+            ? null
+            : createStorageRuntimeOwnershipBinding(storageRuntime);
         const targetConfirmation = storageRuntime?.identity.storageMigrationId === undefined
             ? null
             : createStorageTargetConfirmationHandler({
@@ -172,7 +175,8 @@ async function main() {
             ? {
                 ready: false,
                 statusOutboxPath: join(storageRuntime.local.stateRoot, "storage-status-outbox.json"),
-                identity: storageRuntime.identity,
+                identity: targetStorageBinding.identity,
+                bindServerIdentity: targetStorageBinding.bind,
                 ...(targetConfirmation === null ? {} : { confirm: targetConfirmation.handle }),
                 ...(storageRuntime.identity.storageMigrationId === undefined ? {} : {
                     replayStatus: async (send) => {

package/dist/serve.js

@@ -54,7 +54,7 @@ import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
 import { resolveDaemonLocalStateRootFromEnv } from "./daemon-local-home.js";
-import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
+import { attachStorageMigrationRuntime, bindStorageMigrationServerIdentity, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
 const ACTIVITY_MAP = {
@@ -316,6 +316,7 @@ export function serve(config, opts = {}) {
         let connectionEpochToken;
         ws.on("open", () => {
             connectionEpochToken = projectSkillsController.beginConnectionEpoch();
+            storageMigrationRuntime.beginIdentityBinding();
             const openedSocket = ws;
             backoff = 1000;
             connectedAt = Date.now();
@@ -811,16 +812,21 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
-                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
-                    try {
-                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId, machineId: r.machineId });
-                        machineHelloPublisher.republish();
-                    }
-                    catch (error) {
-                        dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", {
-                            level: "ERROR", error_message: error.message,
-                        });
-                    }
+                if (opts.storageMigration !== undefined && typeof r.workspaceId === "string" && typeof r.machineId === "string") {
+                    const bindingSocket = ws;
+                    bindStorageMigrationServerIdentity(opts.storageMigration, { workspaceId: r.workspaceId, machineId: r.machineId }, {
+                        onBound: () => {
+                            if (bindingSocket !== ws || bindingSocket?.readyState !== WebSocket.OPEN)
+                                return;
+                            storageMigrationRuntime.completeIdentityBinding();
+                            machineHelloPublisher.republish();
+                        },
+                        onError: (error) => {
+                            dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", { level: "ERROR", error_message: error.message });
+                            if (bindingSocket === ws && bindingSocket?.readyState === WebSocket.OPEN)
+                                bindingSocket.close(1011, "storage identity binding failed");
+                        },
+                    });
                 }
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)

package/dist/storage-identity.js

@@ -4,6 +4,9 @@ import { createStorageOwnershipClaim } from "./storage-ownership.js";
 function fingerprint(namespace, value) {
     return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
 }
+export function storageWorkspaceRootFingerprint(workspaceRoot) {
+    return fingerprint("workspace-root", workspaceRoot);
+}
 export function storageIdFingerprint(storageId) {
     return fingerprint("storage", storageId);
 }
@@ -15,7 +18,7 @@ export function storageHelloIdentity(input) {
         || installation.runtimeRoot !== layout.runtimeRoot) {
         throw new Error("installation storage identity does not match resolved layout");
     }
-    const workspaceRootFingerprint = fingerprint("workspace-root", layout.workspaceRoot);
+    const workspaceRootFingerprint = storageWorkspaceRootFingerprint(layout.workspaceRoot);
     let ownership;
     if (input.ownership !== undefined) {
         const { claimFingerprint: reportedFingerprint, ...claimIdentity } = input.ownership;

package/dist/storage-ownership.js

@@ -1,8 +1,11 @@
-import { createHash } from "node:crypto";
-import { lstat, readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, open, readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { z } from "zod";
+import { atomicRenameNoReplace } from "./atomic-no-replace-rename.js";
+import { durableDirectorySync } from "./atomic-private-write.js";
 const FingerprintSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const UuidSchema = z.string().uuid();
 const StorageOwnershipClaimSchema = z.object({
     version: z.literal(1),
     machineId: z.string().uuid(),
@@ -38,8 +41,10 @@ export function createStorageOwnershipClaim(input) {
 export function storageOwnershipClaimPath(nowworkHome) {
     return join(nowworkHome, "storage-layout.json");
 }
-export async function readStorageOwnershipClaim(nowworkHome) {
-    const path = storageOwnershipClaimPath(nowworkHome);
+export function workspaceStorageOwnershipClaimPath(nowworkHome, workspaceId) {
+    return join(nowworkHome, ".storage-ownership", `${UuidSchema.parse(workspaceId).toLowerCase()}.json`);
+}
+async function readClaim(path) {
     const metadata = await lstat(path);
     if (!metadata.isFile())
         throw new Error("storage ownership claim must be a file");
@@ -53,3 +58,86 @@ export async function readStorageOwnershipClaim(nowworkHome) {
     }
     return expected;
 }
+function missingClaim(message) {
+    return Object.assign(new Error(message), { code: "ENOENT" });
+}
+export async function readStorageOwnershipClaim(nowworkHome, workspaceId) {
+    if (workspaceId !== undefined) {
+        const normalizedWorkspaceId = UuidSchema.parse(workspaceId).toLowerCase();
+        try {
+            return await readClaim(workspaceStorageOwnershipClaimPath(nowworkHome, normalizedWorkspaceId));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const legacy = await readClaim(storageOwnershipClaimPath(nowworkHome));
+        if (legacy.workspaceId !== normalizedWorkspaceId) {
+            throw missingClaim(`storage ownership claim is not provisioned for workspace '${normalizedWorkspaceId}'`);
+        }
+        return legacy;
+    }
+    return readClaim(storageOwnershipClaimPath(nowworkHome));
+}
+export async function resolveWorkspaceStorageOwnershipClaim(input) {
+    const machineId = UuidSchema.parse(input.machineId).toLowerCase();
+    const workspaceId = UuidSchema.parse(input.workspaceId).toLowerCase();
+    try {
+        const existing = await readStorageOwnershipClaim(input.nowworkHome, workspaceId);
+        const expected = createStorageOwnershipClaim({
+            machineId,
+            workspaceId,
+            environment: input.environment,
+            volumeFingerprint: existing.volumeFingerprint,
+            workspaceRootFingerprint: input.workspaceRootFingerprint,
+            ownerEpoch: existing.ownerEpoch,
+        });
+        if (existing.claimFingerprint !== expected.claimFingerprint) {
+            throw new Error("storage ownership claim conflicts with the authenticated workspace identity");
+        }
+        return existing;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const anchor = await readClaim(storageOwnershipClaimPath(input.nowworkHome));
+    if (anchor.environment !== input.environment.toLowerCase()) {
+        throw new Error("storage ownership volume anchor environment does not match");
+    }
+    const claim = createStorageOwnershipClaim({
+        machineId,
+        workspaceId,
+        environment: input.environment,
+        volumeFingerprint: anchor.volumeFingerprint,
+        workspaceRootFingerprint: input.workspaceRootFingerprint,
+        ownerEpoch: 1,
+    });
+    const path = workspaceStorageOwnershipClaimPath(input.nowworkHome, workspaceId);
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    let handle = null;
+    try {
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(`${JSON.stringify({ version: 1, ...claim })}\n`, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        const published = await atomicRenameNoReplace(temporary, path);
+        if (published === "published") {
+            await durableDirectorySync(directory);
+            return claim;
+        }
+        const raced = await readClaim(path);
+        if (raced.claimFingerprint !== claim.claimFingerprint) {
+            throw new Error("storage ownership claim was concurrently provisioned for another identity");
+        }
+        return raced;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}

package/dist/storage-runtime-controller.js

@@ -5,12 +5,13 @@ import { buildServiceSpec } from "./computer-service.js";
 import { buildManagedServiceRecord } from "./managed-service-lifecycle.js";
 import { createStorageControlController } from "./storage-control.js";
 import { runStorageDoctor } from "./storage-doctor.js";
-import { storageHelloIdentity } from "./storage-identity.js";
+import { storageHelloIdentity, storageWorkspaceRootFingerprint, } from "./storage-identity.js";
 import { storageLayout, validateStorageEnvironment } from "./storage-layout.js";
 import { StorageMigrationFailure } from "./storage-migration-controller.js";
 import { launchStorageMigrationWorker, writeStorageWorkerHandoff } from "./storage-worker-handoff.js";
 import { writeStorageWorkerOperation } from "./storage-worker-operation.js";
 import { latestSourceStorageMigrationReceipt, monitorStorageMigrationStatus, storageMigrationStatusReplay, } from "./storage-status-replay.js";
+import { resolveWorkspaceStorageOwnershipClaim, } from "./storage-ownership.js";
 const UUID = z.string().uuid();
 function fingerprint(value) {
     return `sha256:${createHash("sha256").update(value).digest("hex")}`;
@@ -22,13 +23,13 @@ function deterministicUuid(value) {
     const hex = chars.join("");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
-function storageId(input, workspaceId) {
-    if (input.ownership.workspaceId !== workspaceId || input.ownership.environment !== input.environment) {
+function storageId(input, workspaceId, ownership) {
+    if (ownership.workspaceId !== workspaceId || ownership.environment !== input.environment) {
         throw new Error("Storage ownership claim does not match the migration identity");
     }
-    return `storage_${input.ownership.claimFingerprint.slice("sha256:".length)}`;
+    return `storage_${ownership.claimFingerprint.slice("sha256:".length)}`;
 }
-function installationBase(input, workspaceId, migrationId, createdAt) {
+function installationBase(input, workspaceId, migrationId, createdAt, ownership) {
     const layout = storageLayout({
         nowworkHome: input.nowworkHome,
         environment: input.environment,
@@ -43,7 +44,7 @@ function installationBase(input, workspaceId, migrationId, createdAt) {
         serverUrl: input.serverUrl,
         environment: input.environment,
         workspaceId,
-        storageId: storageId(input, workspaceId),
+        storageId: storageId(input, workspaceId, ownership),
         nowworkHome: input.nowworkHome,
         runtimeRoot: layout.runtimeRoot,
         credentialRef: `profile:${input.profile}`,
@@ -99,6 +100,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         writeHandoff: writeStorageWorkerHandoff,
         launchWorker: launchStorageMigrationWorker,
         monitorWorker: monitorStorageMigrationStatus,
+        resolveOwnership: resolveWorkspaceStorageOwnershipClaim,
         now: () => new Date(),
         ...injected,
     };
@@ -108,6 +110,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
     let gate = null;
     let sendStatus = null;
     let control = null;
+    let ownership = input.ownership;
+    let identityBindTail = Promise.resolve();
     const pendingControlMessages = [];
     let drainingPendingControlMessages = false;
     const drainPendingControlMessages = () => {
@@ -197,8 +201,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
                 backupsRoot: input.local.backupsRoot,
                 backupArtifacts: input.backupArtifacts.map((artifact) => ({ ...artifact })),
                 ownership: {
-                    ownerEpoch: input.ownership.ownerEpoch,
-                    ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                    ownerEpoch: ownership.ownerEpoch,
+                    ownershipClaimFingerprint: ownership.claimFingerprint,
                 },
                 acceptedWarnings: [...input.policy.acceptedWarnings],
             },
@@ -214,7 +218,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             installation: {
                 configRoot: input.local.configRoot,
                 target: {
-                    ...installationBase(input, workspaceId, doctor.manifest.migrationId, createdAt),
+                    ...installationBase(input, workspaceId, doctor.manifest.migrationId, createdAt, ownership),
                     storageMigrationId: doctor.manifest.migrationId,
                 },
             },
@@ -236,8 +240,8 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             sourceStorageFingerprint,
             targetStorageFingerprint: identity.storageIdFingerprint,
             ownership: {
-                ownerEpoch: input.ownership.ownerEpoch,
-                ownershipClaimFingerprint: input.ownership.claimFingerprint,
+                ownerEpoch: ownership.ownerEpoch,
+                ownershipClaimFingerprint: ownership.claimFingerprint,
             },
             runDoctor: async (migrationId) => dependencies.runDoctor(await doctorInput(migrationId)),
             runMigration: async (doctor) => {
@@ -294,7 +298,7 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             sendStatus,
         });
     };
-    const bindServerIdentity = (server) => {
+    const bindServerIdentityOnce = async (server) => {
         const nextWorkspaceId = UUID.parse(server.workspaceId).toLowerCase();
         const nextMachineId = UUID.parse(server.machineId).toLowerCase();
         if (workspaceId !== null && workspaceId !== nextWorkspaceId) {
@@ -303,13 +307,6 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
         if (machineId !== null && machineId !== nextMachineId) {
             throw new Error("Storage migration server machine identity changed");
         }
-        if (input.ownership.workspaceId !== nextWorkspaceId
-            || input.ownership.machineId !== nextMachineId
-            || input.ownership.environment !== input.environment) {
-            throw new Error("Storage ownership claim does not match authenticated server identity");
-        }
-        const createdAt = dependencies.now().toISOString();
-        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt);
         const layout = storageLayout({
             nowworkHome: input.nowworkHome,
             environment: input.environment,
@@ -317,13 +314,36 @@ export function createStorageMigrationRuntimeController(rawInput, injected = {})
             runtimeBase: input.local.runtimeBase,
             platform: input.platform,
         });
-        const nextIdentity = storageHelloIdentity({ installation, layout, ownership: input.ownership });
+        if (ownership.workspaceId !== nextWorkspaceId
+            || ownership.machineId !== nextMachineId
+            || ownership.environment !== input.environment) {
+            ownership = await dependencies.resolveOwnership({
+                nowworkHome: input.nowworkHome,
+                machineId: nextMachineId,
+                workspaceId: nextWorkspaceId,
+                environment: input.environment,
+                workspaceRootFingerprint: storageWorkspaceRootFingerprint(layout.workspaceRoot),
+            });
+        }
+        if (ownership.workspaceId !== nextWorkspaceId
+            || ownership.machineId !== nextMachineId
+            || ownership.environment !== input.environment) {
+            throw new Error("Storage ownership claim does not match authenticated server identity");
+        }
+        const createdAt = dependencies.now().toISOString();
+        const installation = installationBase(input, nextWorkspaceId, undefined, createdAt, ownership);
+        const nextIdentity = storageHelloIdentity({ installation, layout, ownership });
         workspaceId = nextWorkspaceId;
         machineId = nextMachineId;
         identity = nextIdentity;
         ensureControl();
         drainPendingControlMessages();
     };
+    const bindServerIdentity = (server) => {
+        const current = identityBindTail.then(() => bindServerIdentityOnce(server));
+        identityBindTail = current.catch(() => undefined);
+        return current;
+    };
     const attach = (runtime) => {
         gate = runtime.gate;
         sendStatus = runtime.sendStatus;